feat: split-deployment roles (browser-host on LAN + remote bot)

Add JARVIS_ROLE (full|browser|bot) via a run-if-role.sh supervisord guard so
one image serves three layouts. Make Chrome CDP bind configurable (CDP_BIND)
and publishable on the LAN (CDP_PUBLISH_BIND) so a bot on another PC can drive
this host's on-screen Chrome over the internal network (no auth, as requested).

docker/run-if-role.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Role guard for split deployments.
+#
+#   run-if-role.sh <roles-csv> <command...>
+#
+# Runs <command> only when JARVIS_ROLE is one of <roles-csv> (or "full"/unset).
+# Otherwise it idles so supervisord keeps the program slot "running" without
+# doing any work. This lets ONE image serve three layouts:
+#
+#   JARVIS_ROLE=full     (default) everything in one container
+#   JARVIS_ROLE=browser  only the desktop + Chrome + CDP (reused over the LAN)
+#   JARVIS_ROLE=bot      only the bot + bridge + TTS (drives a remote browser
+#                        via CDP_HOST/CDP_PORT)
+set -e
+want="$1"; shift
+role="${JARVIS_ROLE:-full}"
+if [ "$role" = "full" ]; then exec "$@"; fi
+case ",$want," in
+  *",$role,"*) exec "$@" ;;
+esac
+echo "[role-guard] JARVIS_ROLE=$role not in '$want' — idling: $*" >&2
+exec sleep infinity